Home / Knowledge hub / seccomp
Knowledge hub
seccomp
A Linux feature that limits which system calls a container may make.
What it means
seccomp, short for secure computing mode, is a Linux kernel feature that filters the system calls a process may make. System calls are the requests a program sends to the kernel to open files, start processes or change settings. A seccomp profile lists which ones are allowed.
In a container, the profile acts like a short menu. If the program, or an attacker inside it, asks for something off the menu, the kernel refuses or kills the process. Many escape techniques rely on rarely used calls that a normal app never needs. Related ideas include least privilege, applied at the level of the kernel.
Why it matters
Containers share the host's kernel. A flaw in the kernel is reachable from any container that can call the affected function. Filtering calls cuts the number of routes into the kernel, so a break-in inside one container is less likely to turn into control of the machine.
It costs very little once set. For a business that runs customer workloads side by side, a ready-made default profile is a cheap layer that reviewers and cloud benchmarks look for, and that is easy to explain to a reviewer.
How it shows up
Docker applies a default seccomp profile that blocks a number of risky calls. Kubernetes pods run unconfined unless you ask for more. Set seccompProfile to RuntimeDefault in the pod's security context, or enable the kubelet's default. The Pod Security Standards restricted profile requires it. See privileged containers for the setting that switches such limits off.
The common mistakes are running with Unconfined to fix an error and never reverting, and writing custom profiles that nobody maintains. Start from the runtime default. Only write a custom profile if you can test it against what your app really calls.
Questions people ask
seccomp, answered
Does seccomp replace a firewall?
No. A firewall controls network traffic. seccomp controls what a process can ask the kernel to do, on the machine itself.
They protect different layers and are normally used together.
Is seccomp on by default in Kubernetes?
Not by default in most clusters. Pods run unconfined unless the pod spec requests a profile, or the kubelet default is switched on.
Check the setting rather than assume it.
What is the RuntimeDefault profile?
It is the default profile that your container runtime supplies, such as the one shipped with Docker or containerd. It blocks a set of rarely needed, risky calls.
It suits most applications without any tuning.
Why does my app break under a stricter profile?
It probably calls something the profile blocks. Logs from the kernel or runtime usually name the call.
Allow the specific call you need and keep the rest blocked. Keep a note of why each exception exists.
Is seccomp the same as AppArmor?
No. seccomp filters system calls. AppArmor restricts which files and capabilities a program can use, based on a profile.
Both are Linux security modules for tightening a container, and they complement each other.
Sources
Where this comes from
Related
Terms that sit next to this one
Container escape
Breaking out of a container to reach the machine that hosts it.
Privileged container
A container given near-host powers, so a flaw inside it is a flaw in the host.
Pod security standards
Built-in Kubernetes levels that restrict risky settings in pods.
Runtime security
Watching containers while they run for behaviour that should never happen.
Rootless container
A container run as an ordinary user, limiting damage if it is broken into.
What happens after the foothold?
seccomp limits what a compromised container can do. Cyberlop works earlier in the chain, finding the exploitable flaw in the app and proving it with a request, a response and a line of code. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.